Description
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.

This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
Published: 2026-09-16
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Network service denial via OSPFv3 agent crash
Action: Patch Immediately
AI Analysis

Impact

An unauthenticated attacker on the same OSPFv3 broadcast domain can send specially crafted packets that cause the OSPFv3 agent to crash. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers. The vulnerability is tied to improper handling of input in the OSPFv3 protocol stack (CWE-617) and carries a CVSS score of 7, indicating a medium-high impact.

Affected Systems

The flaw affects Arista Networks EOS releases in the 4.36.x train from version 4.36.2F onward, in the 4.35.x train from 4.35.6M onward, in the 4.34.x train from 4.34.8M onward, and in the 4.33.x train from 4.33.10M onward. All earlier EOS versions in these trains are vulnerable.

Risk and Exploitability

The EPSS score is less than 1%, indicating a low but non-zero probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a local network actor in the same OSPFv3 broadcast domain who can send crafted packets without authentication. No evidence of active exploitation in the wild has been reported; however, the crash can cause significant routing disruption in the affected network.

Generated by OpenCVE AI on September 18, 2026 at 10:28 UTC.

Remediation

Vendor Solution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73438 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.8M and later releases in the 4.34.x train - 4.33.10M and later releases in the 4.33.x train No hotfix is available for this issue.

Vendor Workaround

The OSPFv3 authentication feature helps to mitigate this vulnerability. OSPFv3 authentication prevents unauthorized actors from injecting crafted packets into the OSPF domain. Enabling it on all OSPFv3-speaking interfaces ensures that packets from unauthenticated senders are discarded before they can trigger this vulnerability. Per-interface OSPFv3 encryption: Configure ESP-based encryption with authentication on each OSPFv3 interface. All peers on the same interface must use the same SPI, algorithm, and passphrase. switch(config)# interface <interface-name> switch(config-if)# ospfv3 encryption ipsec spi <spi-value> esp aes-256-cbc sha1 passphrase <shared-passphrase> Per-area OSPFv3 configuration: Configure ESP-based encryption with authentication on each OSPFv3 area. switch(config)# router ospfv3 switch(config-router-ospfv3)# address-family ipv4 switch(config-router-ospfv3-af)# area <area-id> encryption ipsec spi <spi-value> esp aes-256-cbc sha1 passphrase <shared-passphrase> switch(config-router-ospfv3-af)# address-family ipv6 switch(config-router-ospfv3-af)# area <area-id> encryption ipsec spi <spi-value> esp aes-256-cbc sha1 passphrase <shared-passphrase> Caution: Enabling OSPFv3 authentication must be coordinated across peering neighbors simultaneously. Applying this configuration to a single peer will temporarily break the routing adjacency, resulting in traffic disruption.

OpenCVE Recommended Actions

  • Update the device to EOS 4.36.2F or later, 4.35.6M or later, 4.34.8M or later, or 4.33.10M or later to apply the vendor fix
  • Enable OSPFv3 authentication across all interfaces or areas; coordinate the change with all peers so that authentication parameters match to avoid adjacency breaks
  • If a patch cannot be applied immediately, configure OSPFv3 encryption with ESP-based authentication on all interfaces and areas to mitigate the vulnerability while maintaining routing stability

Generated by OpenCVE AI on September 18, 2026 at 10:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Arista
Arista eos
Vendors & Products Arista
Arista eos

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers. This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
Title Security Advisory 0172
Weaknesses CWE-617
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}

Subscriptions

Arista Eos
cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2026-09-16T18:03:38.266Z

Reserved: 2026-08-12T16:39:35.977Z

Link: CVE-2026-73438

cve-icon Vulnrichment

Updated: 2026-09-16T18:03:18.420Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T10:16:51.690

Modified: 2026-09-16T19:17:30.513

Link: CVE-2026-73438

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T21:51:45Z

Weaknesses